# CVE-2026-122154: purocean Yank Note JWT signing key disclosure

Source: https://junglewise.ai/threats/cve-2026-122154-a-vulnerability-was-found-in-purocean-yank-note-3-93-0-this  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-11-05  
License: CC BY 4.0 with a link back

CVE-2026-122154 · Severity: medium · CVSS 5.3 · Published 2026-11-05

Yank Note, a desktop note-taking application, exposes its JWT signing key through an unauthenticated settings endpoint. An attacker can retrieve this key and forge admin authentication tokens, gaining complete administrator access including the ability to execute arbitrary code in the application's main process.

Technologies: [Purocean Yank Note](https://junglewise.ai/threats/technologies/yank-note). Vendors: [Purocean](https://junglewise.ai/threats/vendors/purocean).

## Quick answers

**Is CVE-2026-122154 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-122154 being exploited in the wild.

**How severe is CVE-2026-122154?** Medium severity, with a CVSS score of 5.3, published 5 November 2026.

**Which products and versions are affected?** Purocean Yank Note 3.93.0.

**Is there a fix for CVE-2026-122154?** Yes: fixed in 3.93.1. Until then: Restrict network access to the embedded HTTP server on port 3044 to prevent remote access from untrusted networks. Require authentication for the /api/settings endpoint and do not expose the server.jwt-secret key in API responses.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-03","note":"Vulnerability reported as GitHub issue #532"},{"kind":"patched","at":"2026-10-07","note":"Patch committed to guard API origins and keep JWT key server-side"},{"kind":"advisory","at":"2026-11-05","note":"CVE-2026-122154 published"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-122154 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-122154?** Check whether you run Purocean Yank Note at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.93.1

Restrict network access to the embedded HTTP server on port 3044 to prevent remote access from untrusted networks. Require authentication for the /api/settings endpoint and do not expose the server.jwt-secret key in API responses.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-03","note":"Vulnerability reported as GitHub issue #532"},{"kind":"patched","at":"2026-10-07","note":"Patch committed to guard API origins and keep JWT key server-side"},{"kind":"advisory","at":"2026-11-05","note":"CVE-2026-122154 published"}]

## Technical details

The /api/settings endpoint in src/main/server/index.ts returns the complete application configuration, including the server.jwt-secret key used for bearer token authentication, without requiring authentication. An attacker can use this key to forge HS256 JWT tokens with admin role and bypass all authentication mechanisms, gaining access to authenticated admin APIs such as POST /api/rpc which executes arbitrary JavaScript in the Electron main process. The vulnerability affects unauthenticated, locally-reachable instances.

## Affected products

- purocean Yank Note 3.93.0

## References

- [https://github.com/purocean/yn/commit/59f85d48f17a70a402ad59dcecacdbec20f954df](https://github.com/purocean/yn/commit/59f85d48f17a70a402ad59dcecacdbec20f954df)
- [https://github.com/purocean/yn/issues/532](https://github.com/purocean/yn/issues/532)

## Related threats

- [Purocean Yank Note OS command injection in Terminal Handler](https://junglewise.ai/threats/cve-2026-122157-a-vulnerability-was-identified-in-purocean-yank-note-3-93-0)
- [Yank Note path traversal via /api/help](https://junglewise.ai/threats/cve-2026-111915-yank-note-before-3-93-1-contains-a-path-traversal-vulnerability)